Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| IBM | WebSphere Application Server - Liberty | affected |
|
|||||||||
| IBM | WebSphere Application Server | affected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No advisories yet.
Solution
IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH70807 and APAR PH70616. To determine if a feature is enabled for WebSphere Application Server Liberty, refer to How to determine if Liberty is using a specific feature https://www.ibm.com/support/pages/node/6553910 . For IBM WebSphere Application Server Liberty 19.0.0.7 - 26.0.0.5 using the sipServlet-1.1 feature: · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH70807 https://www.ibm.com/support/pages/node/7273237 --OR-- · Apply Fix Pack 26.0.0.6 or later (targeted availability 2Q2026). For IBM WebSphere Application Server traditional: For V9.0.0.0 through 9.0.5.27: · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH70616 https://www.ibm.com/support/pages/node/7269402 --OR-- · Apply Fix Pack 9.0.5.28 or later (targeted availability 2Q2026). For V8.5.0.0 through 8.5.5.29: · Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix that resolves PH70616 https://www.ibm.com/support/pages/node/7269402 --OR-- · Apply Fix Pack 8.5.5.30 or later (targeted availability 3Q2026). Additional interim fixes may be available and linked off the interim fix download page.
Workaround
No workaround given by the vendor.
| Link | Providers |
|---|---|
| https://www.ibm.com/support/pages/node/7273424 |
|
Wed, 27 May 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-399 CWE-770 |
Wed, 27 May 2026 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | IBM WebSphere Application Server - Liberty 19.0.0.7 through 26.0.0.5 and IBM WebSphere Application Server 9.0, and 8.5 and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. | |
| Title | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a denial of service | |
| First Time appeared |
Ibm
Ibm websphere Application Server Ibm websphere Application Server Liberty |
|
| CPEs | cpe:2.3:a:ibm:websphere_application_server:8.5.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server:9.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server___liberty:19.0.0.7:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server___liberty:26.0.0.5:*:*:*:*:*:*:* |
|
| Vendors & Products |
Ibm
Ibm websphere Application Server Ibm websphere Application Server Liberty |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: ibm
Published:
Updated: 2026-05-27T15:25:09.833Z
Reserved: 2026-03-19T02:14:15.887Z
Link: CVE-2026-4410
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-05-27T14:17:33.660
Modified: 2026-05-27T14:53:51.833
Link: CVE-2026-4410
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-27T16:00:08Z